cicd-goat
A deliberately vulnerable CI/CD environment with 11 challenges to learn and practice CI/CD security.
What is cicd-goat?
CI/CD Goat is a deliberately vulnerable CI/CD environment created for security education. It allows engineers and security practitioners to learn CI/CD security through a set of 11 hands-on challenges enacted against a real, full-blown CI/CD pipeline. The project helps users understand common attack vectors and the OWASP Top 10 CI/CD Security Risks in a safe, controlled setting.
Security engineers, DevOps practitioners, and developers who want to understand CI/CD security vulnerabilities and learn how to secure their pipelines. It's also suitable for security training programs and CTF enthusiasts.
Developers choose CI/CD Goat because it provides a realistic, self-contained CI/CD environment with intentional vulnerabilities, enabling practical, hands-on learning without risking production systems. Its coverage of the OWASP Top 10 CI/CD risks and integration with a CTF framework make it a comprehensive educational tool.
Overview
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
Use Cases
Best For
- Learning CI/CD security through hands-on challenges
- Practicing attack techniques in a safe, vulnerable environment
- Understanding the OWASP Top 10 CI/CD Security Risks
- Running security training workshops for DevOps teams
- Preparing for security certifications with practical labs
- Testing security tools against realistic CI/CD vulnerabilities
Not Ideal For
- Teams deploying secure, production-ready CI/CD pipelines that need immediate hardening
- Developers seeking a plug-and-play, secure CI/CD template for application projects
- Environments with limited Docker resources or strict container quotas
- Learners preferring passive, theoretical security training over hands-on challenges
Pros & Cons
Pros
Integrates actual tools like Jenkins, GitLab, and Gitea in a Docker-based environment, providing a realistic simulation of interconnected CI/CD pipelines as shown in the architecture diagram.
Covers 8 out of 10 OWASP Top CI/CD Security Risks, with challenges focused on critical vulnerabilities like Poisoned Pipeline Execution (PPE) and Insufficient Flow Control Mechanisms.
Offers 11 themed challenges with Capture the Flag integration via CTFd, promoting active learning and problem-solving with flags to submit for progress tracking.
Can be set up without cloning the repository using simple Docker Compose commands for Linux, Mac, and Windows, as highlighted in the download instructions.
Cons
Runs nine Docker containers simultaneously, including resource-heavy services like Jenkins and GitLab, which can strain systems with limited CPU or memory, as noted in the troubleshooting section.
Containers may take up to 5 minutes to configure fully, and services like Gitea might show blank pages requiring refreshes, adding friction to the setup process.
The GitHub repository includes a 'solutions' directory and spoilers in files, which could accidentally reveal answers and undermine the self-directed learning experience if browsed.
Frequently Asked Questions
Related Projects
ZapThe ZAP by Checkmarx Core project
Kubernetes GoatKubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
Bad SSL:lock: Memorable site for testing clients against bad SSL configs.
OWASP NodeGoatThe OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.